Runbook section 1 (docs/guides/slice-1-identities.md), run by Sage with the
jarvis admin token on git.mosaicstack.dev (Gitea 1.27.1), 2026-10-09, between 22:21 and 22:23 UTC.
Lead decision 74. Output below is verbatim; it holds names, ids and statuses only.

$ node setup.mjs pm
mosaic-stack-pm-bot: create HTTP 201 id=114 admin=false restricted=true
mosaic-stack-pm-bot: collaborator write HTTP 204
mosaic-stack-pm-bot: token "mosaic-stack-pm-2026-10-09" HTTP 201 id=191 scopes=write:issue,read:repository,read:user

$ node setup.mjs cto coder reviewer
mosaic-stack-cto-bot: create HTTP 201 id=115 admin=false restricted=true
mosaic-stack-cto-bot: collaborator write HTTP 204
mosaic-stack-cto-bot: token "mosaic-stack-cto-2026-10-09" HTTP 201 id=192 scopes=write:issue,write:repository,read:user
mosaic-stack-coder-bot: create HTTP 201 id=116 admin=false restricted=true
mosaic-stack-coder-bot: collaborator write HTTP 204
mosaic-stack-coder-bot: token "mosaic-stack-coder-2026-10-09" HTTP 201 id=193 scopes=write:issue,write:repository,read:user
mosaic-stack-reviewer-bot: create HTTP 201 id=117 admin=false restricted=true
mosaic-stack-reviewer-bot: collaborator read HTTP 204
mosaic-stack-reviewer-bot: token "mosaic-stack-reviewer-2026-10-09" HTTP 201 id=194 scopes=write:issue,write:repository,read:user

$ node verify.mjs
pm: user=200 login=mosaic-stack-pm-bot admin=false | repo=200 push=true admin=false pull=true | issues=200 | admin/users=403 | org repos=403 n=-
cto: user=200 login=mosaic-stack-cto-bot admin=false | repo=200 push=true admin=false pull=true | issues=200 | admin/users=403 | org repos=403 n=-
coder: user=200 login=mosaic-stack-coder-bot admin=false | repo=200 push=true admin=false pull=true | issues=200 | admin/users=403 | org repos=403 n=-
reviewer: user=200 login=mosaic-stack-reviewer-bot admin=false | repo=200 push=false admin=false pull=true | issues=200 | admin/users=403 | org repos=403 n=-

$ stat -c '%a %s %n' ~/.config/mosaic-dev/secrets/mosaic-stack/*
600 40 .../mosaic-stack/coder-gitea.token
600 40 .../mosaic-stack/cto-gitea.token
600 40 .../mosaic-stack/pm-gitea.token
600 40 .../mosaic-stack/reviewer-gitea.token

Branch protections on mosaicstack/stack before and after: main and next,
push, merge and approvals allowlists all empty. No bot is on any.

Revocation check, pm bot, about 22:25 UTC: PATCH admin/users prohibit_login=true
(HTTP 200), then verify.mjs pm gave user=403 repo=403 issues=403. PATCH
prohibit_login=false (HTTP 200, restricted=true admin=false), then verify.mjs pm
gave user=200 repo=200 push=true issues=200 admin/users=403. prohibit_login
stops a bot's tokens at once, and clearing it restores them.
